fix: wip

packages/lib/server-only/field/get-fields-for-token.ts

@@ -1,6 +1,8 @@
 import { prisma } from '@documenso/prisma';
 import { EnvelopeType, FieldType, RecipientRole, SigningStatus } from '@prisma/client';
 
+import { getLaterSigningStepRecipientsWhereInput } from '../../utils/recipients';
+
 export type GetFieldsForTokenOptions = {
   token: string;
 };
@@ -31,10 +33,11 @@ export const getFieldsForToken = async ({ token }: GetFieldsForTokenOptions) =>
               signingStatus: {
                 not: SigningStatus.SIGNED,
               },
-              signingOrder: {
-                gte: recipient.signingOrder ?? 0,
-              },
               envelopeId: recipient.envelopeId,
+              // Assistants can only assist those in strictly later steps —
+              // never their own group peers, with null orders as the tail
+              // step. (Own fields are matched by the sibling OR arm.)
+              AND: [getLaterSigningStepRecipientsWhereInput(recipient)],
             },
             envelope: {
               id: recipient.envelopeId,

packages/lib/server-only/field/remove-signed-field-with-token.ts

@@ -1,7 +1,7 @@
 import { DOCUMENT_AUDIT_LOG_TYPE } from '@documenso/lib/types/document-audit-logs';
 import type { RequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '@documenso/lib/utils/document-audit-logs';
-import { assertRecipientNotExpired } from '@documenso/lib/utils/recipients';
+import { assertRecipientNotExpired, getFieldOwnerWhereInput } from '@documenso/lib/utils/recipients';
 import { prisma } from '@documenso/prisma';
 import { DocumentStatus, RecipientRole, SigningStatus } from '@prisma/client';
 
@@ -25,21 +25,7 @@ export const removeSignedFieldWithToken = async ({
   const field = await prisma.field.findFirstOrThrow({
     where: {
       id: fieldId,
-      recipient: {
-        ...(recipient.role !== RecipientRole.ASSISTANT
-          ? {
-              id: recipient.id,
-            }
-          : {
-              signingOrder: {
-                gte: recipient.signingOrder ?? 0,
-              },
-              signingStatus: {
-                not: SigningStatus.SIGNED,
-              },
-              envelopeId: recipient.envelopeId,
-            }),
-      },
+      recipient: getFieldOwnerWhereInput(recipient),
     },
     include: {
       envelope: true,

packages/lib/server-only/field/sign-field-with-token.ts

@@ -13,6 +13,7 @@ import { match } from 'ts-pattern';
 import { AUTO_SIGNABLE_FIELD_TYPES } from '../../constants/autosign';
 import { DEFAULT_DOCUMENT_DATE_FORMAT } from '../../constants/date-formats';
 import { DEFAULT_DOCUMENT_TIME_ZONE } from '../../constants/time-zones';
+import { AppError, AppErrorCode } from '../../errors/app-error';
 import { DOCUMENT_AUDIT_LOG_TYPE } from '../../types/document-audit-logs';
 import type { TRecipientActionAuth } from '../../types/document-auth';
 import {
@@ -24,7 +25,7 @@ import {
 } from '../../types/field-meta';
 import type { RequestMetadata } from '../../universal/extract-request-metadata';
 import { createDocumentAuditLogData } from '../../utils/document-audit-logs';
-import { assertRecipientNotExpired } from '../../utils/recipients';
+import { assertRecipientNotExpired, getFieldOwnerWhereInput } from '../../utils/recipients';
 import { validateFieldAuth } from '../document/validate-field-auth';
 
 export type SignFieldWithTokenOptions = {
@@ -65,21 +66,7 @@ export const signFieldWithToken = async ({
   const field = await prisma.field.findFirstOrThrow({
     where: {
       id: fieldId,
-      recipient: {
-        ...(recipient.role !== RecipientRole.ASSISTANT
-          ? {
-              id: recipient.id,
-            }
-          : {
-              signingStatus: {
-                not: SigningStatus.SIGNED,
-              },
-              signingOrder: {
-                gte: recipient.signingOrder ?? 0,
-              },
-              envelopeId: recipient.envelopeId,
-            }),
-      },
+      recipient: getFieldOwnerWhereInput(recipient),
     },
     include: {
       envelope: {
@@ -124,6 +111,18 @@ export const signFieldWithToken = async ({
     throw new Error(`Field ${fieldId} has no recipientId`);
   }
 
+  // Mirrors the V2 guard in `sign-envelope-field.ts`: assistants may prefill
+  // other recipients' fields but never their signature fields.
+  if (
+    field.type === FieldType.SIGNATURE &&
+    recipient.role === RecipientRole.ASSISTANT &&
+    field.recipientId !== recipient.id
+  ) {
+    throw new AppError(AppErrorCode.INVALID_REQUEST, {
+      message: 'Assistant recipients cannot sign signature fields',
+    });
+  }
+
   if (field.type === FieldType.NUMBER && field.fieldMeta) {
     const numberFieldParsedMeta = ZNumberFieldMeta.parse(field.fieldMeta);
     const errors = validateNumberField(value, numberFieldParsedMeta, true);